Hello everyone,
I am hoping to create a reference guide for all those looking for antivirus exclusion lists (files, folders and/or
processes that should not be scanned by AV) for common applications. I found the following links, which were extremely
helpful: (
http://myitforum.com/cs2/blogs/scassells/archive/2007/05/14/what-anti-virus-scanning-exclusions-should-be-considered-for-system-and-
servers.as
px) and (
http://support.microsoft.com/kb/822158/) and
(
http://support.microsoft.com/kb/943556) Please help me augment my growing list. (The person who donates the most
exclusions gets the points)
Here is what I have generated so far. Feel free to comment if you feel I am an idiot for those listed. AND THANKS for
your help:
All Windows 2003 and Windows XP (the following are applied to all systems):
Directories = \windows\SoftwareDistribut
ion\Datast
ore, \windows\SoftwareDistribut
ion\Datast
ore\Logs,
Files extensions = log, chk, edb, (and Wsusscan.cab, Wsusscn2.cab)
Windows infrastructure services - Active Directory/DNS/DHCP/File Replication/WSUS/IIS:
Directories to exclude = \windows\ntds, \windows\system32\dns, \windows\system32\dhcp, \windows\ntfrs,
\windows\system32\inetsrv,
\inetpub, :\windows\iis temporary compressed files,
FRS_Replica_root\DO_NOT_RE
MOVE_NtFrs
_PreInstal
l_Director
y
File extensions to exclude = BTR, DBF, SBF, DB, MDX, NDX, MDW, LDB, MDF, NDF, TMP, BIN, DIT, PAT, JDB, dat
Processes = java.exe, msiexec.exe, INETINFO.EXE
Windows Cluster:
Directories = Q:\ (Quorum drive), \windows\Cluster
Sharepoint:
Directories = \Program Files\SharePoint Portal Server, \Program Files\Common Files\Microsoft Shared\Web Storage System,
\MSDEDatabases
SMS:
Directories = SMS\Inboxes, SMS_CCM\ServiceData
- Office 2003 and 2007: (Don't have any, just hoping to spur your thoughts on it since I deploy it across our entire
organization.)
- Exchange 2003:
Directories = \program files\exchsrvr\mailroot,\p
rogram files\exchsvr\mdbdata, M:\, \program files\exchsrvr\mtadata,
\windows\system32\MSMQ
File extensions = eml, stm, dat, dat
Processes = EMSMTA.exe, MAD.EXE, STORE.EXE , DSAMAIN.EXE , ISINTEG.EXE, ESEUTIL.EXE, MTACHECK.EXE, INETINFO.EXE,
SRSMAIN.EXE
- SQL 2000 and 2005
File extensions = mdf, ldf, ndf
- VMware Infrastructure
Processes: vmwareservice.exe, vmware-ufad.exe
- Computer Associates
Directories: CA install folder
Processes: caavppc.exe, inort.exe
Thanks a billion!